Consistent sub Across Multiple Connectors

[mitchellkellett]

I’m working with an application that identifies users solely by their sub claim, and I can’t change this behaviour. I understand that by default, Dex generates the sub claim as a combination of:

1. A unique ID provided by the external OIDC provider.
2. A unique ID from the Dex configuration that identifies the external provider.

This means that the same user signing in through different connectors (e.g., Google, Microsoft, Apple, GitHub, etc.) will have a different sub, which causes the application to treat them as separate identities.

I’m looking for a workaround or alternative functionality to make Dex return the same sub for a user regardless of the connector they use. This would allow seamless sign-in with any provider, as long as the user account matches (e.g., by email or another shared identifier).

Is there a way to achieve this in Dex? By using a specific sub format or mapping the claim across connectors? Any guidance or suggestions would be greatly appreciated.